How Stillfold Keeps Documents Private
What happens to a document after you add it, who can open it, and the one place where we make an exception. In plain words, with nothing left out.
The Short Version
Your documents are locked on your phone before they go anywhere. Stillfold’s server keeps a copy so your shelves are backed up and shared with your family, but that copy is scrambled, and we don’t have the key to unscramble it.
The key to each shelf lives only on the phones of the people on that shelf. That’s what end-to-end encrypted means here: the two ends are your family’s phones, and nothing in between can read what travels or what’s stored.
There is one exception, and it’s off unless you turn it on: Auto-fill details. It’s explained plainly below.
On Your Phone
When you add a document, Stillfold encrypts the photo, the PDF and every detail (names, numbers, dates, notes) on your phone, with the key of the shelf it goes on. Only then is it backed up.
- Stillfold’s own storage on your phone is encrypted too. Its database and files are locked with a key kept in your phone’s secure storage.
- App lock. Stillfold can ask for Face ID or your phone’s passcode when it opens, and again after the time you choose.
- Left out of phone backups. Stillfold’s files are kept out of iCloud and device backups, because they can’t be read anywhere else. Your backup is Stillfold’s own encrypted sync.
- Works offline. Everything you need is on the phone. Changes sync when you’re back online.
On Our Server
Our server stores what it needs to back up and sync your shelves, and nothing it can read about your documents.
| We can’t see | We can see |
|---|---|
| Your documents, photos and PDFs | Your email address and name |
| Names of your shelves | How you sign in (Apple, Google or email) |
| Names of the people on your shelves | The names of your signed-in devices |
| Document details: numbers, dates, notes | Which accounts are on which shelf, and their roles |
| What’s in a share link | How much storage your shelves use, and when things changed |
If someone broke into our server, they would find the same scrambled data we hold, and no keys to open it.
Shelves and Their Keys
Each shelf has its own key. A “Just me” shelf’s key is only ever on your phones. A family shelf’s key is on the phones of the people you’ve invited to it, and no one else’s.
When someone accepts an invite, the shelf’s key is passed to them by the phone of someone already on the shelf, locked so that only the new member’s phone can open it. This happens the next time that phone opens Stillfold, usually within moments. Our server carries the locked key but can’t open it.
Roles decide what each person can do on a shelf. A Manager can invite people and change roles, an Editor can add and change documents, and a Viewer can see and present them. Up to 20 people can be on a shelf.
Invites
An invite is a link sent by email. The secret part of the link sits after the “#”, a part of a web address that browsers never send to a server, so it never reaches ours. It shows up only in the email and on the phone that opens it.
- An invite only works for the email address it was sent to.
- It lasts 14 days, and a Manager can resend or cancel it.
- The email says who invited you, so you can ignore one you don’t expect.
Auto-fill Details: the One Exception
Auto-fill reads the names, numbers and dates on a new document and fills in the form for you. To do that well, the picture has to be read by a service that can see it. So for Auto-fill, and only Auto-fill, a document leaves your phone in a form that can be read.
- It’s off until you agree. Stillfold asks first, and explains what happens, before it’s used. You can turn it off at any time under You, Auto-fill details.
- What is sent. The pictures of the new document’s pages, over an encrypted connection, to our server, which passes them to a reading service and returns the details to your phone.
- What is kept. Nothing. Our server holds the pictures in memory only while they’re read. It doesn’t save them or write them to its logs. The reading service is used only through providers that agree to keep nothing and not to use what they see for anything else.
- What isn’t covered. For that moment, the picture isn’t protected by Stillfold’s own encryption. It’s protected by the encrypted connection and the no-keeping rules above.
- Some reading never leaves the phone. The barcode on a US driver’s licence or state ID is read exactly on your phone and used to cross-check the rest.
Fields Auto-fill isn’t sure of are marked so you can check them. If you would rather not use it, type the details yourself. Everything else in Stillfold works the same.
Getting Back In
Because only your phones hold your keys, Stillfold gives you three ways to bring them to a new phone:
- Your phone’s own backup of your key. On iPhone, iCloud Keychain can keep your Stillfold key, so a new iPhone signed in to the same Apple account can pick it up. (On Android, Google’s backup will play the same part.)
- Approve from a phone you already use. Sign in on the new phone and approve it from your old one.
- Your recovery code. Stillfold gives you a recovery code to print or write down. Keep it somewhere safe, away from your phone.
If you lose every phone and your recovery code, nobody can get your documents back, including us. We never have your key, so we can’t reset it for you. That’s the cost of real privacy, and it’s why the recovery code matters.
Signing In and Leaving
You sign in with Apple, Google, or a code sent to your email. Your account is what lets your shelves back up and reach your family; it doesn’t open your documents. Your keys do that.
You can delete your account from the app at any time: You, then Delete account. Shelves only you are on are deleted, you leave shared shelves, and your share links stop working. See how to delete your account and our Privacy Policy for details.
Reporting a Problem
If you think you’ve found a security problem in Stillfold, please email support@stillfold.app with what you found and how to reproduce it. Please don’t include anyone’s real documents. We’ll reply and keep you posted on the fix.